Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Malware Analysis · hypnguyen1209 | DecimalAI

securityby hypnguyen1209

Malware Analysis

hypnguyen1209/malware-analysis

Source hypnguyen1209/offensive-claude ↗License MIT

Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)

SkillScore91Maintained

Automatic

Security & AppSec pack

Last verified 8/21/2026

What it changes

Passed 19 of 21 test cases with the skill, and 11 of 21 without it.

Without skill50%

With skill91%

Checks it passed that the model alone missed

Invokes mem_triage.py with the --patch-hunt flag.
Invokes beacon_profiler.py on the PCAP capture file.
Specifies JSON output location using --json out/triage.json.

and 10 more in the full report

9 fixed11 passed either way2 still failing0 broke

Pass-rate lift: +41 pp
Tokens: +96%
Agent turns: 0%
Response time: -11%

Model gemini-3.6-flashMeasured 8/21/2026v120 of 22 cases passed with skill · 21 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/hypnguyen1209-malware-analysis/SKILL.md https://app.decimal.ai/s/hypnguyen1209-malware-analysis/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add hypnguyen1209-malware-analysis, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/hypnguyen1209-malware-analysis/ and pins it in .decimal/skills.lock

decimalai skills add hypnguyen1209-malware-analysis

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hypnguyen1209-malware-analysis/SKILL.md https://app.decimal.ai/s/hypnguyen1209-malware-analysis/SKILL.md

Raw file: /s/hypnguyen1209-malware-analysis/SKILL.md ↗ · machine-readable summary at /s/hypnguyen1209-malware-analysis.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 9

Prompt

Outline the command-line command to run full static triage on a PE file named sample.exe using a Python script, ensuring it includes FLOSS string extraction, capability analysis, YARA-X rule checking, and formatted JSON output saved to out/triage.json.

What was checked, without and with the skill
Checked	Without skill	With skill
Includes flags --floss, --capa, and --yara in the triage.py command line.	Missed	Passed
Specifies JSON output location using --json out/triage.json.	Missed	Passed

case-03 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md86 lines14 filesincludes scripts

Malware Analysis

When to Activate

Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).
Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).
Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.
Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).
Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies	T1027	CWE-506	references/static-triage-capa.md	scripts/triage.py
Per-section entropy + packer/RWX/EP heuristics	T1027.002	CWE-1066	references/static-triage-capa.md	scripts/triage.py
Obfuscated string recovery (FLOSS)	T1140, T1027.013	CWE-656	references/static-triage-capa.md	scripts/triage.py
Capability detection → ATT&CK (capa, static+dynamic)	T1027	CWE-506	references/static-triage-capa.md	scripts/triage.py
Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling)	T1140, T1620	CWE-656	references/unpacking-deobfuscation.md	scripts/auto_unpack.py
DBI unpacking via API hooks (Frida)	T1055, T1620	CWE-656	references/unpacking-deobfuscation.md	scripts/frida_unpack.js
.NET deobfuscation/unpacking (de4dot/dnSpyEx)	T1027, T1140	CWE-656	references/unpacking-deobfuscation.md	scripts/frida_unpack.js
Sandbox detonation + behavioral capture	T1497	CWE-506	references/dynamic-fileless-memory.md	scripts/mem_triage.py
Memory injection/hollowing/ghosting analysis (Vol3)	T1055, T1055.012	CWE-506	references/dynamic-fileless-memory.md	scripts/mem_triage.py
AMSI/ETW in-memory patch + patchless detection	T1562.001	CWE-693	references/dynamic-fileless-memory.md	scripts/mem_triage.py
Fileless WMI/registry/PowerShell persistence	T1546.003, T1547.001, T1059.001	CWE-506	references/dynamic-fileless-memory.md	scripts/mem_triage.py
Cobalt Strike / AdaptixC2 config extraction	T1071.001, T1573	CWE-798	references/config-c2-extraction.md	scripts/cs_config_extract.py
Config framework at scale (MACO/CAPE)	T1071.001	CWE-798	references/config-c2-extraction.md	scripts/cs_config_extract.py
Generic unknown-C2 protocol RE + decoder	T1573, T1071.004	CWE-311	references/config-c2-extraction.md	scripts/cs_config_extract.py
Beacon cadence/jitter detection (PCAP/Zeek)	T1071.001, T1029	CWE-778	references/network-c2-detection.md	scripts/beacon_profiler.py
JA4+ TLS/HTTP/cert fingerprinting (Sliver/Havoc JA4X)	T1071.001, T1573	CWE-295	references/network-c2-detection.md	scripts/beacon_profiler.py
Tunneled/DoH C2 surfacing (cloudflared/chisel)	T1572, T1568.002, T1071.004	CWE-441	references/network-c2-detection.md	scripts/beacon_profiler.py
YARA-X family rule authoring + FP validation	T1027	CWE-506	references/yara-detection-engineering.md	scripts/yara_gen.py

Quick Start

# 1. Static triage: hashes + PE anomalies + capability combos + FLOSS/capa/YARA-X
python3 scripts/triage.py sample.exe --floss --capa --yara rules/family.yar --json out/triage.json
capa -j sample.exe > out/capa.json                       # capabilities -> ATT&CK

Track record

Benchmark

19 / 21

test cases passed, vs 11 / 21 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

hypnguyen1209 / offensive-claude

skills/malware-analysis/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 13 files · scripts

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

Malware Analysis

When to Activate

Technique Map

Quick Start

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills